As of January 1, 2025, the Attorney General is tasked with protecting the rights of Nebraska residents to their personal data. As part of the law, the Attorney General is required to provide information that helps businesses and consumers understand their rights and responsibilities under the Data Privacy Act, Neb. Rev. Stat. §§ 87-1101 to 87-1130.
Businesses and organizations have different responsibilities based on whether they control or process Nebraskans’ personal data. Nebraskan consumers have rights under the Data Privacy Act, allowing them greater control over their personal data. Click the links below for a more detailed explanation of how the Data Privacy Act impacts each group.
Which businesses and organizations does the Data Privacy Act apply to?
This act applies to any person, including entities, that:
- Conducts business in this state or produces a product or service consumed by residents of this state;
- Processes or engages in the sale of personal data; AND
- Is not a small business as determined under the federal Small Business Act as it existed on January 1, 2024. A small business may still be liable for penalties if it sells sensitive data without receiving consent from the consumer.
What is personal data?
Personal data means any information reasonably linkable to an identifiable individual, including “Sensitive Data” (see Neb. Rev. Stat. § 87-1102 for more information on sensitive data). Personal can also include pseudonymous data when the data is used by a controller in conjunction with additional information that reasonably links the data to a person. Personal Data DOES NOT include publicly available information or data that cannot be reasonably linked to an individual.
What does it mean to process data?
Processing is the collection, use, storage, disclosure, analysis, deletion, modification, or modification of personal data.
Exceptions to the Data Privacy Act?
- Neb. Rev. Stat. § 87-1103 lists the Businesses and Organizations excluded from the Data Privacy Act.
- Neb. Rev. Stat. § 87-1104 lists the information excluded from the Data Privacy Act.
- Neb. Rev. Stat. § 87-1105 and Neb. Rev. Stat. § 87-1106 list the Uses Excluded from the Data Privacy Act.
